agenttesla | c58d9ec5ba4c70e96be638ec40130d52e3cd2a98fb967d18d8197eed66c4efb5 | Triage

Submit
Reports

Overview

overview

Static

static

7

extservice...er.exe

windows7-x64

extservice...er.exe

windows10-2004-x64

Sharing

General

Target

extservices_spoofer.exe
Size

6.5MB
Sample

240907-sl6fzazdln
MD5

08099816c5239f034c0b5117ea206077
SHA1

b6f5dfbbf182e2ba0d93a9ce2e251d17a704908e
SHA256

c58d9ec5ba4c70e96be638ec40130d52e3cd2a98fb967d18d8197eed66c4efb5
SHA512

467a6fae9fb40fa5281b15748b5fc561c8a6332a9e5d9c08ec24e3dab0dbbd2cb66edb9a1aa9e194c9cee19617bbcb31a28a67d9318525d2e683631c527e7afb
SSDEEP

98304:BU5TmmrMKVH51OUfB/wPHcW2g/GTa51vf52LtwcYnZ9FRTVjylC8XyUasv:BUV7MKBN5/ocW2XWvh8wzFRoZyUh

Score

10^/10

agenttesla discovery evasion keylogger spyware stealer themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

extservices_spoofer.exe

Resource

win7-20240903-en

agenttesla discovery evasion keylogger spyware stealer themida trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

extservices_spoofer.exe

Resource

win10v2004-20240802-en

agenttesla discovery evasion keylogger spyware stealer themida trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  extservices_spoofer.exe
- Size
  
  6.5MB
- MD5
  
  08099816c5239f034c0b5117ea206077
- SHA1
  
  b6f5dfbbf182e2ba0d93a9ce2e251d17a704908e
- SHA256
  
  c58d9ec5ba4c70e96be638ec40130d52e3cd2a98fb967d18d8197eed66c4efb5
- SHA512
  
  467a6fae9fb40fa5281b15748b5fc561c8a6332a9e5d9c08ec24e3dab0dbbd2cb66edb9a1aa9e194c9cee19617bbcb31a28a67d9318525d2e683631c527e7afb
- SSDEEP
  
  98304:BU5TmmrMKVH51OUfB/wPHcW2g/GTa51vf52LtwcYnZ9FRTVjylC8XyUasv:BUV7MKBN5/ocW2XWvh8wzFRoZyUh
Score

10^/10

agenttesla discovery evasion keylogger spyware stealer themida trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agenttesladiscoveryevasionkeyloggerspywarestealerthemidatrojan

behavioral2

agenttesladiscoveryevasionkeyloggerspywarestealerthemidatrojan

© 2018-2025

Terms | Privacy